Card-not-present fraud occurs when stolen or compromised payment credentials are used without the physical card being presented, commonly in e-commerce or other remote transactions.
8 min read
Key takeaways
- Holiday volume can make card-not-present fraud, card testing and automated attacks harder to distinguish from typical transaction activity. Stronger controls work best when they stay targeted.
- Risk-based monitoring and layered checks can help protect against fraud without creating unnecessary false declines or hurting approval rates.
- Looking across fraud losses, approvals, chargebacks and review workload can give merchants a clearer view of how well their controls are performing.
$257.8 B
U.S. online holiday spending from November 1 through December 31, 2025, was up 6.8% year over year, according to Adobe Analytics.1
For e-commerce merchants, one of the biggest concerns is card-not-present (CNP) fraud, which involves using payment credentials fraudulently when the physical card isn’t presented.
Fraud pressure tends to rise when merchants are busiest. CNP fraud, card testing, chargeback abuse and automated attacks can all increase operational strain at the same time teams are trying to keep checkout moving.
144%
More suspected fraudulent activity was blocked by certain card networks globally over the 2025 Black Friday and Cyber Monday weekend than during the same period a year earlier.2
Merchants balance CNP fraud prevention with the customer experience. Controls ideally reduce losses while preserving legitimate approvals, authorization rates and revenue.
Why does card-not-present fraud increase during holiday shopping?
Peak shopping periods give fraudsters more activity to blend into. A sudden increase in transactions can make unusual behavior harder to isolate, while operations teams have less time to investigate each exception.
Card testing is an automated fraud tactic in which stolen or compromised card credentials are tested through low-dollar transactions to determine whether they’re active. Attackers may then use validated credentials for fraudulent purchases.3 CNP fraud can be difficult to distinguish from valid e-commerce activity because the transaction itself may look ordinary.
High holiday volumes can also make automated attacks harder to isolate. That makes transaction context increasingly important. Customer, payment and transaction patterns can help merchants identify activity that may warrant additional review.
What does holiday card-not-present fraud look like?
Fraud during peak shopping periods can take several forms. Merchants may see compromised cards used for online purchases, bursts of low-value card-testing attempts or dispute abuse that surfaces after an order has been fulfilled.
AI can make fraudulent activity easier to automate and scale. During peak shopping periods, higher volumes can make that activity harder to distinguish from normal customer behavior.4 That puts more pressure on merchants to identify risk without adding unnecessary friction for legitimate customers.
The financial impact can extend well beyond the original purchase. The FBI reports that credit card fraud accounted for $282 million in losses in 2025, while non-payment and non-delivery scams resulted in more than $503 million in losses.5 The agency also notes that complaint volume often rises in the early months of the year, suggesting a connection to holiday-season scams.
How can merchants reduce fraud without increasing false declines?
Tightening controls across the board may help protect against some fraud, but it can also create unnecessary friction for customers.
Overly restrictive controls can create false declines—where legitimate transactions are rejected as suspicious—and reduce authorization rates, the share of transactions approved.6 During the holidays, that added friction comes at a particularly important point in the customer journey.
A more targeted approach applies additional scrutiny where risk is higher, while allowing lower-risk activity to move with less interruption. Using multiple checks can support that balance by bringing together different signals rather than relying on a single rule or threshold.7
Merchants can also adjust controls as behavior changes throughout the season. A pattern that looks unusual in October may be completely normal during a major shopping weekend. That balance can help merchants respond to changing fraud patterns without adding unnecessary friction at checkout.
How fraud can affect revenue, operations and customer trust
Chargebacks can create work long after the original purchase. Teams may need to investigate disputes, gather documentation and respond within network timelines, adding costs that can affect the bottom line. Card-testing attacks can create additional processing costs and may also lead to payment network monitoring, chargebacks and potential fines.8
False declines create a different kind of loss. A shopper whose purchase is incorrectly declined may abandon it entirely, reducing revenue and potentially weakening the customer relationship.
There’s also a broader confidence issue. Customers expect payment experiences to feel both secure and easy. Fraud controls that add checkout steps or delays can work against that experience, while streamlined payments can support customer loyalty.9
That’s why fraud performance should be considered alongside authorization rates, dispute levels and customer experience. Looking across fraud losses, false declines, chargebacks, conversion and review workload can give merchants a fuller picture of how their controls are performing.
How can merchants prepare for peak-season fraud?
Preparation starts before transaction volumes rise. Merchants can focus on a few areas as peak season approaches:
- Historical fraud and dispute patterns can show where exceptions tend to cluster.
- Monitoring changes in transaction activity, declines and card testing can help teams spot seasonal shifts.10
- Controls can be adjusted as seasonal patterns change, so expected increases in volume do not automatically trigger unnecessary declines.
- Clear escalation processes can help teams understand how suspicious activity should be handled.
Technology plays an important role, but the surrounding processes matter just as much. Fraud tools should support secure, compliant payment experiences while giving teams enough visibility to understand why activity is being flagged and how controls are performing.
Frequently asked questions
Card testing uses small, repeated authorization attempts to determine whether stolen card credentials are still active. Successful credentials may then be used for larger fraudulent purchases.
Risk-based controls can apply more scrutiny to higher-risk activity while allowing lower-risk transactions to move with less friction. Monitoring performance across fraud losses, false declines and authorization rates can help merchants understand whether controls are working as intended.
Useful measures include fraud loss, false-decline rates, authorization or approval rates, chargeback rates, conversion and manual-review workload. Looking at those measures together gives a more complete picture than relying on one metric alone.
The bottom line
Holiday shopping creates a narrow window in which merchants need to move quickly without losing control of risk. The strongest fraud strategies are built around that balance: identifying high-risk activity early while keeping valid customers moving.
That requires monitoring, adaptable controls and a clear view of how fraud decisions affect approvals, disputes and customer experience.
Fraud tactics will continue to evolve. Preparing early and adapting controls as patterns change can help merchants respond without adding unnecessary checkout friction or losing sight of customer trust and growth.
Explore more fraud-prevention insights
Learn more about how merchants can adapt fraud controls as payment risks evolve.
References
1.
Reuters, “US online holiday spending hits record levels despite slower growth, Adobe says”, January 7, 2026
3.
J.P. Morgan, “Card testing 101: Spot it Early, Stop it Fast” July 9, 2026
5.
Federal Bureau of Investigation, “Holiday Scams”
6.
J.P. Morgan, “Six ways merchants can help prevent card testing attacks,” February 22, 2023
7.
J.P. Morgan, “Six ways merchants can help prevent card testing attacks,” February 22, 2023
8.
J.P. Morgan, “Card testing 101: Spot it early, stop it fast,” July 9, 2026
9.
J.P. Morgan, “Managing operational complexity in digital commerce,” October 23, 2025
10.
J.P. Morgan, “Card testing 101: Spot it early, stop it fast,” July 9, 2026
Disclaimer
J.P. Morgan, JPMorganChase, Chase, Chase Merchant Services, and Chase Payment Solutions are marketing names for certain businesses of JPMorganChase and its subsidiaries worldwide (collectively, “JPMorganChase”). Products or services may be marketed and/or provided by commercial banks such as JPMorgan Chase Bank, N.A., securities or other non-banking affiliates or other JPMorganChase entities. JPMorganChase contact persons may be employees or officers of any of the foregoing entities and the terms “J.P. Morgan”, “JPMorganChase”, “Chase”, “Chase Merchant Services” and “Chase Payment Solutions” if and as used herein include as applicable all such employees or officers and/or entities irrespective of marketing name(s) used. Nothing in this material is a solicitation by JPMorganChase of any product or service which would be unlawful under applicable laws or regulations.
In preparing this material, we have relied upon and assumed, without independent verification, the accuracy and completeness of all information available from public sources or which was provided to us or which was otherwise reviewed by us. This material is for discussion purposes only and is incomplete without reference to any other applicable briefings provided by JPMorganChase. Neither this material nor any of its contents may be disclosed or used for any other purpose without the prior written consent of JPMorganChase.
This material is not intended to provide legal, tax, investment, accounting, financial, business, real estate, technology or other advice, and should not be used for or relied upon for these purposes. The views, opinions, estimates and strategies expressed in this material are those of the respective individual contributors, authors or speakers, and may differ from those of JPMorganChase, or its employees and affiliates. Any market and/or economic commentary in this material in no way constitutes JPMorganChase research and should not be treated as such. Further, the views expressed in this content may differ from those contained in JPMorganChase research reports. The content in this material has been obtained from sources deemed to be reliable, but JPMorganChase makes no representation or warranty as to its accuracy or completeness. In no event shall JPMorganChase nor any of its directors, officers, employees or agents be liable for any use of, for any decision made or action taken in reliance upon, or for any inaccuracies or errors in or omissions from, this material.
The information in this document may be based upon management forecasts supplied to us and reflects prevailing conditions and our views as of this date, all of which are accordingly subject to change. JPMorganChase’s opinions and estimates constitute J.P. Morgan’s judgment and should be regarded as indicative, preliminary and for illustrative purposes only.
Not all products and services are available in all geographic areas. Eligibility for particular products and services is subject to final determination by JPMorganChase and or its affiliates. This material does not constitute a commitment by any JPMorganChase entity to extend or arrange credit or to provide any other products or services and JPMorganChase reserves the right to withdraw at any time. All products and services are subject to applicable laws, regulations, and applicable approvals and notifications.
Any mentions of third-party trademarks, brand names, products and services are for referential purposes only and any mention thereof is not meant to imply any sponsorship, endorsement, or affiliation.
Notwithstanding anything to the contrary, the statements in this material are not intended to be legally binding. Any products, services, terms or other matters described herein (other than in respect of confidentiality) are subject to, and superseded by, the terms of separate legally binding documentation and/or are subject to change without notice.
JPMorgan Chase Bank, N.A. Member FDIC. Deposits held in non-U.S. branches are not FDIC insured. Non-deposit products are not FDIC insured.
JPMorgan Chase Bank, N.A., organized under the laws of U.S.A. with limited liability.
© 2026 JPMorgan Chase & Co. All Rights Reserved.
